JP5574610B2 - Fault tolerant design and safety assurance device for personal vehicles - Google Patents

Description

Detailed Description of the Invention

TECHNICAL FIELD OF THE INVENTION The present invention relates to system design for powered vehicles, and more particularly to surplus characteristics of system design.
BACKGROUND OF THE INVENTION

A personal vehicle, such as used by a disabled person, may be, for example, a self-propelled, user-inducible one, and even when only two wheels are grounded at the same time, 1 Stabilization may be required in the above-described front and rear or left and right planes. More particularly, such a vehicle is indicated generally by the numeral 10 in FIG. A vehicle 10 for transporting a user 12 or other payload includes one or more wheels 16 or a group of wheels 16 (cluster) 14 in which each wheel and / or each cluster is powered equally or independently. Such vehicles are disclosed in US Pat. No. 5,701,965 and US Patent Publication No. 08 / 384,705, which are hereby incorporated by reference. This type of vehicle can be operated more effectively and safely when using system design features in addition to those disclosed in the prior art.

According to a preferred embodiment of the present invention, a vehicle for land movement capable of detecting a failure is provided. The vehicle includes a support structure for supporting a load, a ground module for providing mobility to the support structure, and a motor drive configuration that allows for controllable movement of the ground element. Have. In addition, the vehicle has a plurality of control elements, each control element having an output and another output of the first control element to identify which one of the first and other control elements is faulty. It has a comparator that compares the output with two control elements. The control element may include a sensor that senses at least one position and direction and a plurality of redundant control channels, each control channel being capable of independently controlling the motor drive, and the plurality of processors are: Each redundant control channel is connected by a system bus. Each processor has an output, and each processor can receive input commands from a user, signals from sensors, and the output of each other processor.

According to an alternative embodiment of the invention, the control element may be selected between a plurality of sensors and a plurality of control channels for sensing the position or direction of the vehicle, each control channel being a motor driven Can be controlled independently. The control element may also include a plurality of processors connected to the control channel by a system bus, the system bus including a plurality of processors and at least one user input set, a battery capacity display, a temperature display, a seat A high control unit and a failure protection control unit may be included. The output of either control element can be supplied at a speed that exceeds the mechanical response speed of the motor drive. Each processor may be capable of receiving input commands from the user, signals from sensors, and outputs of each other processor, and the comparator receives processor outputs to identify which processor is faulty. The comparison may also include a disconnect circuit for disconnecting the failed processor from the system bus, and the fault has been identified in such a way as to allow continuous operation of the vehicle using all other processors. The output of any processor may be suppressed.

According to a further embodiment of the invention, a support structure for supporting a load, a grounding element for providing movement capability to the support structure, a grounding element movable with respect to the axle relative to the local axis, and a local shaft A vehicle is provided having a motorized drive to allow controllable movement of the grounding element relative to the axle and to allow movement of the axle so that is moved relative to the substrate structure. A sensor is provided for sensing at least one position and direction of the vehicle. Like multiple control channels, each control channel can control the motor drive independently. The vehicle has a plurality of processors connected to the control channel by a system bus and a comparator for comparing the outputs of the processors for identifying which processor is faulty. Each processor has an output, and each processor can receive input commands from a user, signals from sensors, and respective outputs of other processors. The vehicle may have a motor drive with multiple extra windings.

According to another embodiment of the present invention, a fail-safe joystick (manual operation device) is provided. The joystick has a centering mechanism for returning the joystick to the center position when released by the user, and a sensor for detecting the joystick at the center position.

Detailed Description of the Preferred Embodiment

The invention will be more readily understood by reference to the following description, taken in conjunction with the accompanying drawings, in which:

In FIG. 1, the base portion of the vehicle 10 includes a support 18 for supporting a user 12, a ground module 20 for transporting the support 18, and one or more for driving wheels 16 and / or clusters 14. Actuator mechanism (not shown) and one or more controls for controlling the actuator mechanism in accordance with the desired parameter input according to the measured time ratio of the position and arrangement of the user and the vehicle, as well as the changes in the position and arrangement of the vehicle May be configured to include the portion, the time ratio at which the change is measured, and the configuration of the vehicle 10, but is not limited thereto. The position and / or placement of the vehicle is monitored by a set of sensors (not shown) whose output is used by one or more controllers, either continuously or periodically. By way of example, sensors that provide displacement and tilt information may be subject to specific control laws and as disclosed in US Pat. No. 5,701,965 and US patent application Ser. No. 08 / 384,705, Allows the controller to calculate the torque applied to the vehicle wheel or cluster.

By way of illustration, the term “ground” as used in reference to the expression “grounding module 20” or in connection with the surface on which the vehicle 10 moves is the interior of a building surrounded by any surface moved by the vehicle 10. Or it may be outside. The term “personal transporter” is used herein interchangeably with the term “vehicle”. In addition, the term “wheels” may equally include arcuate elements or other grounding members that can propel the vehicle 10 on the ground. “Position” of the vehicle means a fixed reference point with respect to the ground, whereas “configuration” means the arrangement of the components of the vehicle with respect to each other. It includes properties such as seat height, axis tilt, etc., as well as settings made in software, such as, without limitation, specific speed, acceleration, joystick sensitivity, etc. In particular, according to a preferred embodiment of the present invention, the wheel 16 rotates about the axle 22. The axle 22 rotates around the cluster axle 24 that constitutes the axis of cluster rotation. The support 18 can then be raised or lowered with respect to the cluster 14. Other internal degrees of freedom present in the vehicle 10 are also included within the term “arrangement” as used herein and in the appended claims. Similarly, directions or inclinations represented by the angle of the vehicle 10 with respect to gravity are also included within the scope of the term “arrangement”.

User input may be provided by a user who is transported by the vehicle by means of a joystick or other interface, or by tilting the user, or by applying force to an external object. In addition, user input may be provided by an assistant that is not carried by the vehicle. He may dominate the movement and / or placement of the vehicle by applying force to the auxiliary handle to attempt to tilt the vehicle. Alternatively, user input may be provided by an assistant by a control module that is separate from the vehicle. Here, the control module includes a joystick, switch, or keypad input, or any other method. “Sensor” refers to any device for monitoring any feature of a vehicle's physical position or placement, for example, an inclinometer, gyroscope, or any angle such as a wheel or cluster to measure tilt. The direction indicated by and its rate of change are included.

Safe operation of a vehicle after a certain type of failure may require one or more failure margins of the basic vehicle parts listed above. As used in this description and the appended claims, “redundancy” means the duplication of certain components that contribute to the vehicle's fault margin. “Surplus” also means data oversampling. Thus, for example, data can be provided by the sensor at a rate substantially higher than the mechanical response rate of the system. In this case, if the data is altered on the system bus or elsewhere, it does not result in a system response because new data is provided before the response must be provided. In the preferred embodiment of the present invention, the basic vehicle parts are electronically interconnected in the system architecture, as shown by way of example in the block diagram of FIG. 2 to be described.

With each power supply 30, the combination of sensor electronics 34 and control processors 24, 26, and 28 is collectively referred to as a power base 32. The power base 32 includes a number of power base processors 36, each of which includes sensor electronics 34, central processing units (CPUs) 24, 26 and 28, and a power supply 30. Each CPU 28 has an associated power supply 30 and sensor electronics board 34.

The power base 32 is electronically connected to an interface 38 for receiving user input, as well as other controls around the vehicle or for controlling special functions. Other control units and peripheral devices connected to the power base 32 include a seat height control unit 40, as well as a crash protection control unit 42 and a crash protection monitor 44, and a battery charger and monitor (not shown). However, it is not limited to these. The crash protection controller 42 may include one or more airbag arrangements, or alternatively, as described in pending US Provisional Application No. 60 / 064,175, filed Nov. 4, 1997. As described in U.S. Provisional Application No. 60 / 061,974 filed Oct. 14, 1997, such as the separation of support 18 from ground module 20 (shown in FIG. 1). Various functions may be provided. Communication between the user interface 38, the peripheral controllers 40 and 42, and each of the power base processors 24, 26, and 28 of the power base 32 is via a system serial bus 45. In the preferred embodiment, it is an asynchronous channel with a capacity of 250 kBaud and using a time division multiple access (TDMA) protocol.

The actuator for the wheel 16 and cluster 14 (shown in FIG. 1) is typically a motor, such as the left wheel motor 51, and in the preferred embodiment, the actuator is a servo motor. The actuator 51 for the left wheel may be driven by either of the surplus left wheel amplifiers 46 and 48. Similarly, the right wheel amplifier 50 drives the actuator for the right wheel, and the cluster amplifier 52 drives the cluster actuator. In the preferred embodiment of the invention, the load sharing power channel is provided by which both the left wheel amplifiers 46 and 48 are required for the full performance of the left wheel motor 51. However, each left wheel amplifier can provide a short time limited performance to allow the vehicle to come to safely stand still. A power channel may also be referred to as a “control channel” herein and in the appended claims. Additional surplus may be supplied to each motor 51 so that half of each motor's windings provide sufficient torque for vehicle operation. Each redundant full set of amplifiers 46, 50, and 52 is controlled by one of power amplifier controllers 54 and 56. In particular, it is advantageous to supply the full current to the servomotor via the wheel amplifiers 46 and 48 so that a strong current series element is not required between the battery and the motor. Communication between the surplus power base processors 24, 26, and 28 and the power amplifier controller 54 is via the power base serial bus 58 to provide the surplus power processors 24, 26, and 28 to provide full surplus. Communication with the power amplifier control unit 56 is via the second power base serial bus 60.

As can be evaluated in light of the system description above with reference to FIG. 2, the control architecture associated with the vehicle is highly redundant due to the different static indeterminate orders imparted to the various components of the system. May be.

Some issues must be dealt with taking into account the surplus described above. One problem is the allocation of control and decisions that occur when surplus components exist simultaneously and are active.

Serial Bus Control According to the preferred TDMA protocol described above, each device on the serial bus 45 has an assigned time slot for transferring and spreading predefined data sets. All devices on the serial bus 45 are programmed to respond to or follow a particular sender of data based on software-configurable control registers. Serial bus 45 is referred to as a serial bus master, eg, power base processors 24, 26, and 28 corresponding to a “Master Power Base Processor” shown herein as processor 24 for illustrative purposes. Controlled by one specific processor. The serial bus master controls the master synchronization packet and bus error data collection. In the case of a master power base processor interface failure, the “secondary power base master” determined as described below serves as the system serial bus mastership.

Critical components of fault operation If the operation of components is most important for putting the vehicle in safe mode without endangering the vehicle occupant, a fault-tolerant triple surplus is the preferred implementation of the present invention. According to the form, it is used to create fault handling functionality. An example of a critical component of failure operation is a power-based processor, supplied as any of the three and shown as power-based processors 24, 26, and 28 in FIG. Each of the power-based processors 24, 26, and 28 is also an important sensor for which a reliable output is required to compensate for critical vehicle functionality including vehicle balance, battery condition, etc. Tied to a specific set. Thereby, a single point of failure of any processor or sensor can be detected. In addition, according to one embodiment of the present invention, detection of faults in the operation of any processor or detector is communicated to and from the currently controlling power-based processor to the user interface 38, where Is communicated to the user by visual or non-visual indicators. Non-visual indicators include, but are not limited to, those that can be perceived by audible alerts or tactile means, to name two examples. Another means of non-visual indication to alert the user to potential hazards is the superposition of intermittent drive signals in the wheel drive amplifier, either periodic or aperiodic, thereby An uneven movement of the vehicle that is perceived by the passenger is created.

In the case of triple surplus sensors or processors, faults are detected by comparing the data supplied by the remaining pair of surplus sensors with the data supplied by each sensor, thereby creating fault handling functionality. Also good. Here, if the vehicle is determined to be defective (in the described comparison or otherwise), the vehicle enters safe mode without risking the vehicle occupants. Until then, it may continue to operate based on information provided by the remaining sensors. In such cases, the remaining sensors or processors may be required to match within defined limits in order to continue to operate at a reduced level of vehicle functionality. The operation may then be terminated immediately in the event of a mismatch between the remaining sensors or processors. The comparator may be any erroneous processor or sensor serial bus 45, 58, and 60 using electronic switch circuitry or software running on at least one power-based processor, as is well known to those skilled in the electronics arts. Provided to disable connection to. For example, in one mode of operation, the power amplifier controller (PAC) stores the results from the power base processor (PBP) A and PBP B. If the two results are the same, the PAC uses the result from PBP A because both are correct. If the two results of PBP A and PBP B are different, the PAC waits for one cycle until instructed what to do. The PBP's C signals the failing processor to shut itself down in the second cycle, and in the third cycle, the PAC hears only from the working PBP and follows its instructions.

Critical components to ensure safety If a component failure is tolerated during the time required for the vehicle to finish safely, double redundant components are used. For sensors that fall into this category, a single sensor failure is detected by comparing the output of each sensor. If a discrepancy is detected, the operation of the vehicle is terminated safely, thereby providing functionality that ensures safety. Functionality to ensure safety is typically the motor 51, wheel amplifiers 46, 48, and the like, as well as force handles (used for external control of the vehicle), brakes, and seat equipment in the ground module. 50, cluster amplifier 52, and power amplifier controllers 54 and 56.

Faults are detected in the case of non-redundant sensors based on sensor output characteristics specific to sensor failure modes or compared to expected performance. The non-surplus sensor may include, for example, a sheet height encoder.

Joystick to Ensure Safety In FIG. 3, a joystick mechanism to ensure safety is shown, generally indicated by the numeral 60 with a joystick 62 that automatically returns to the center. Whereas a standard potentiometer joystick can cause a failure that causes the device attached to the joystick to drift or cause a “hard over” condition, the joystick mechanism 60 is independent of detecting when the joystick 62 is in the center position. Provide a means. For example, the sensor 64, which may be a Hall effect sensor, senses when the joystick column 66 is at the center position in alignment with the sensor 64. Potentiometers 68 and 70 sense the position of joystick 62 with respect to two orthogonal axes. If one of the potentiometers 68 and 70 fails, if the joystick 60 is released, it will automatically return to the center, so the joystick 60 will return to the center and the sensor 64 Engage, thereby providing a signal to a system that is independent of the fault potentiometer system.

Accompanying operational limitations In addition to detecting component failures as described above, in alternative embodiments of the present invention, additional controller characteristics may be provided to provide vehicle occupant safety. Good. In various modes of vehicle control, such as described in US Pat. No. 5,701,965 and US patent application Ser. No. 08 / 384,705, torque is controlled by an internal control target such as user input or vehicle balance. Applied to an appropriate set of clusters or wheels to achieve the specific control goal to be determined. When a vehicle wheel temporarily loses contact with the ground, the rotation of the levitating wheel is not a certain amount of vehicle position relative to the ground, but the rotation of the wheel in controlling the application of torque to the wheel. The effect must be limited, effectively limiting the acceleration of the wheel under these circumstances.

An additional base for limiting speed includes a reference to remaining battery capacity or headroom so that sufficient reserve torque is always available to maintain vehicle stability. Furthermore, if the motor is used for power regeneration, the vehicle speed may be limited to prevent overcharging of the battery when going down the slope. Similarly, shunt regulator dissipation requirements can be reduced by reducing the maximum speed of the descending vehicle. In addition, vehicle speed may be limited on the basis of seat height according to lateral stability constraints. In addition to speed limitation, the mode of operation of the vehicle may be limited based on the failure data obtained as described above.

The described embodiments of the present invention are intended to be exemplary only, and numerous variations and modifications will be apparent to those skilled in the art. All variations and modifications are intended to be within the scope of the present invention as defined in the appended claims.

FIG. 1 is a side view of a prior art personal vehicle of the type in which an embodiment of the present invention may be advantageously used. FIG. 2 is a block diagram of a control structure for controlling a personal vehicle in a preferred embodiment of the present invention. FIG. 3 is a perspective view of a fail-safe joystick according to one embodiment of the present invention.

Claims (7)

A method for controlling movement of a vehicle, comprising:
a. Supplying a plurality of control channels to the vehicle , wherein each control channel can independently control a motor drive that advances the vehicle; and
b. supplying a plurality of sensors to the vehicle, each sensor supplying data based on at least one of the position and direction of the vehicle;
c. supplying a plurality of processors to the vehicle , each processor supplying an output based on at least a portion of the data supplied by the sensor to each of the control channels via a system bus;
d. comparing the output of the processor;
e. identifying a fault in the output of the processor ;
f. controlling the vehicle on the basis of the output of a processor other than the processor that provides the output having the identified fault. The method of claim 1, further comprising providing a disconnect circuit for removing a processor that provides an output having an identified fault from the system bus. 2. The system of claim 1, further comprising: connecting the plurality of processors through the system bus to at least one of a set of user input, battery capacity indicator, temperature indicator, seat height controller, and fault protection controller. Method. The method of claim 1, further comprising providing the output of at least one sensor of the plurality of sensors at a speed that exceeds a mechanical response speed of the motor drive. The method of claim 1, wherein an identification of a fault in the output of the processor is communicated to a user interface. The method of claim 1, wherein the identification of the fault in the output of the processor is communicated to the vehicle user by at least one of visual and non-visual indicator means. The method of claim 6, wherein the non-visual indicator is at least one of a combination of an audible alarm, a tactile alarm, and an intermittent superposition of drive signals in a wheel drive amplifier.

Images